Independent engineering for institutional DeFi
Operational Assurance for Onchain Capital
For teams whose counterparties settle on what their on-chain positions are worth. Reconciliation monitors, execution checks and operational controls, built hands-on and handed over.
Classes of failure the checks are built to catch
- Stale valuation inputs
- Positions that do not reconcile
- Ledger drift between systems
- Valid but wrong transactions
- Silent keeper failures
- Mandate and exposure breaches
- Unreviewed control changes
- Alerts without an owner
About Anastasiu Labs
Assurance for the Number Everyone Settles On
Contract security asks whether a transaction is malicious. Operational assurance asks whether a number is true. Anastasiu Labs works on the second question, alongside the security tooling you already run.
Monitoring & Reconciliation
Financial invariants, feed freshness and position reconciliation, with explicit failure states.
Execution Assurance
Decode, simulate and verify before signing. Assert the outcome after execution.
Operations Infrastructure
Automation, integrations and signer workflows that are observable and owned.
Engagements
Four Ways to Engage, Each with Its Edges Drawn
Scope, timeline and commercial terms are agreed in writing before work begins. Every format states what is included, and what is not.
- Typically 2–4 weeks
Operational Risk Review
A structured walk through one workflow (valuation, settlement, signing or automation) to find where it can be wrong without anyone noticing.
- Deliverable
- Ranked findings, a proposed check set and hands-on help with remediation.
- Not included
- A formal smart contract audit.
- Fixed scope
Invariant Monitor Build
One economically meaningful check, such as NAV reconciliation or feed freshness, taken all the way to production.
- Deliverable
- A running monitor with five-state output, alert routing, audit trail and runbook.
- Not included
- Automatic pauses or interventions, unless explicitly scoped.
- Fixed scope or phased
Execution Workflow Hardening
Safe and multisig flows that decode and simulate before signing, and assert the outcome after execution.
- Deliverable
- Pre-signing verification, post-execution checks and reliable automation.
- Not included
- Holding keys or signing on your behalf.
- Multi-month
Embedded Senior Engineering
Senior engineering inside your team through a sustained build, an integration or a critical period.
- Deliverable
- Working code and infrastructure, reviewed and owned by your team.
- Not included
- Open-ended roles without a defined scope.
Track record
Proven in Production
The method comes from systems Tudor Anastasiu built and ran as an engineer at these organizations, before founding the practice.
Employer · Tenderly
Pre-execution security and monitoring operators can act on
Led Security Simulations engineering: execution-trace scanners and risk aggregation to cut noise. Drove monitoring architecture, including a composable, expression-based alerting model.
Employer · Sherpa.trade
Execution infrastructure, built as founding engineer
Safe-based trading on Arbitrum and Monad: upgradeable settlement contracts with simulation safety checks, EIP-712 order commitments and a guarded executor backend.
Employer · ParaSwap
Incident response under real conditions
Managed incident response and recovery through the March 2023 USDC depeg. Scaled on-chain RFQ volume tenfold and onboarded over a dozen private market makers.
Employer · Google Zürich
Reliability at hyperscale
Migrated a legacy YouTube import pipeline to an asynchronous workflow system, with alerting, on-call and a progressive rollout to millions of users.
Organizations listed are previous employers of the founder. They are not clients or partners of Anastasiu Labs, and no endorsement is implied.
The Anastasiu Labs Difference
Security tooling watches for attackers. Anastasiu Labs checks whether the number is true.
Read-only First
Monitoring needs no keys. Any authority to act is scoped separately, in writing.
Provenance on Every Number
Each alert carries its sources, block numbers, timestamps and arithmetic.
Tolerances with Reasons
Thresholds come from rounding and timing, not from what makes an alert go quiet.
Senior-led, Direct Access
The engineer who scopes the work is the one who builds it. No intermediaries.
Built to be Owned
Documented, tested and handed over. Long-term dependency is a failure mode.
Method
Five States, Not Two
Most monitors report healthy or broken. The dangerous case sits in between: a check that could not read its data and said nothing. Every check built here reports one of five states, and says why.
- PASS
Every input was read, fresh, and the assertion held.
- FAIL
Inputs were trustworthy and the assertion was violated.
- STALE
An input was read but is older than its stated cadence.
- UNAVAILABLE
A source could not be read. Never reported as healthy.
- INDETERMINATE
Data was read but cannot settle the question, for example across mismatched cutoffs.
Example fund position · cutoff block 24,118,302
- shares
- 12,480,113.42
- on-chain read
- × price
- 1.0412
- feed · 2h old, cadence 24h
- + cash
- 402,118.90
- on-chain read
- = expected
- 13,396,412.99
- published
- 13,512,870.00
- last updated 31h ago
- Δ
- −116,457.01
- −0.86% vs ±0.05% tolerance
Escalate to the valuation owner before the next settlement window.
- price.freshnessPASS
- keeper.settlementUNAVAILABLE
Start narrow.
Prove one check.
Breadth comes later, and only once the first check has earned it.
- 01
Walk through a near miss
One workflow, and the last time it went wrong or nearly did.
- 02
Scope in writing
Which invariant matters, what data it needs, who owns the alert, what is out of bounds.
- 03
Build one check, fully
Live state, explicit failure states, an audit trail and a runbook.
- 04
Hand over, or extend
Your team owns it. Further checks only if the first one earned them.
Notes
Writing on operational assurance: what to monitor, what to deliberately leave out, and what a system should do when it cannot read.
When the monitor cannot read
Why “no data” must never look like “no problem”, and what a check should do instead.
How to mitigate Balancer-like exploits with invariant monitoring
Written while at Tenderly: how real-time monitoring of core invariants could limit the damage of attacks like the Balancer V2 exploit.
Bring your last near miss. Anastasiu Labs will tell you whether a check would have caught it.
Or write to tg.anastasiu@gmail.com. Initial conversations are confidential, and NDAs are welcome before details are shared.
- What broke, or nearly did
- How it was detected, and by whom
- What was exposed while it went unnoticed
- What you would want caught next time
Frequently Asked Questions
What is Anastasiu Labs?
An independent engineering practice for institutional DeFi operations. It builds monitoring, reconciliation, execution checks and operational tooling for teams that move or account for capital on-chain. It is the practice founded by Tudor Anastasiu, operating today as Anastasiu Tudor-Grigore PFA, registered in Romania.
Who does the work?
Today every engagement is led and delivered personally by the founder, Tudor Anastasiu, a blockchain infrastructure and security engineer previously at Google, ParaSwap, Sherpa.trade and Tenderly. The practice is growing a small team of senior engineers held to the same standard; anyone added to your engagement is introduced and agreed with you in writing first.
Is this a smart contract audit?
No. An audit checks code. This work checks operations: whether valuations, positions, transactions and workflows behave as the business intends. It complements an audit rather than replacing it.
Do you hold keys or sign transactions?
No. Monitoring needs read access only. The practice does not hold keys, or sign or submit transactions on your behalf. Any authority to act, such as an automated pause, is scoped separately and in writing.
Which chains do you work with?
Ethereum and EVM-compatible networks, where all of the founder’s production experience is. Other virtual machines are not offered today.
Do you provide 24/7 monitoring or managed operations?
No. The practice builds monitors along with the alert routing, runbooks and escalation paths around them. Your team, or your existing provider, operates them. Round-the-clock coverage is not offered.
How are engagements priced?
Fixed scope with agreed acceptance criteria, or time-based for embedded work. Scope, timeline and commercial terms are agreed in writing before work begins.
Will you reference our work publicly?
Not without written permission. Initial conversations are confidential, and NDAs can be signed before any details are shared.